ClickFix Base64 Regsvr32 OCX Execution via Explorer Run Dialog (TinyEgg)

Duo Tech@duotech

•updated Jul 24, 2026•2•0•5

Detects the ClickFix execution chain: base64-encoded regsvr32 command pasted into the Windows Run dialog, staging TinyEgg as an OCX payload.